rustls / rustls/rcgen

KeyPair::from_pem detects incorrect algorithm?

Open
#193 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
505
Forks
157
Avg merge
39m
Merged PRs (30d)
1

Description

How to reproduce

Test certificates
Working certificates (-sha256 option)
openssl req -x509 \
                        -sha256 -days 356 \
                        -nodes \
                        -newkey rsa:4096 \
                        -subj "/CN=example.com" \
                        -keyout rootCA.key -out rootCA.crt
Failing certificates (-sha512 option)
openssl req -x509 \
                        -sha512 -days 356 \
                        -nodes \
                        -newkey rsa:4096 \
                        -subj "/CN=example.com" \
                        -keyout rootCA.key -out rootCA.crt
Code
use std::fs::read_to_string;

fn main() {
    let private_key = read_to_string("rootCA.key").unwrap();
    let private_key = rcgen::KeyPair::from_pem(&private_key).unwrap();
    println!("KeyPair alg: {:?}", private_key.algorithm());

    let cert = read_to_string("rootCA.crt").unwrap();
    let params = rcgen::CertificateParams::from_ca_cert_pem(&cert, private_key).unwrap();

    println!("Params alg: {:?}", params.alg);

    if let Err(e) = rcgen::Certificate::from_params(params) {
        println!("Error: {:#}", e);
    } else {
        println!("All good :-)")
    };
}
Test results

If using the -sha256 certificate files, the output is:

KeyPair alg: PKCS_RSA_SHA256
Params alg: PKCS_RSA_SHA256
All good :-)

If using the -sha512 certificate files, the output is:

KeyPair alg: PKCS_RSA_SHA256
Params alg: PKCS_RSA_SHA512
Error: The provided certificate's signature algorithm is incompatible with the given key pair

Is this expected?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the supplied OpenSSL commands and Rust example, then inspect KeyPair::from_pem and CertificateParams::from_ca_cert_pem to compare the SHA-256 and SHA-512 algorithm values. Done means establishing whether the differing algorithms are expected and documenting or covering the correct compatibility behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.